CRA reporting deadlines: 24h, 72h, and 14 days
CRA reporting is a clock-driven workflow. When an actively exploited vulnerability or severe incident triggers the regulation, teams need fast triage, clear ownership, structured facts, and defensible evidence for each deadline.
24-hour early warning
The 24-hour early warning is the first high-pressure CRA reporting milestone. Teams need to identify whether the vulnerability or incident is in scope, determine exploitation status, capture affected products, and prepare the minimum required facts without waiting for perfect information.
- Track discovery time and awareness time as evidence.
- Link the report to affected products, SBOMs, versions, and vulnerability identifiers.
- Keep the early warning narrow, factual, and auditable.
72-hour full notification
The 72-hour full notification expands the facts available at early warning. Teams should add technical analysis, impact assessment, remediation status, supply chain context, and any available mitigation or patch timeline.
- Assign owner, reviewer, and approver roles before the deadline begins.
- Use prebuilt fields so PSIRT, product, and legal teams do not invent the process during an incident.
- Keep the notification linked to immutable internal evidence.
14-day final report
The final report should close the loop with root cause, remediation, impact, affected users or products, and evidence of corrective action. A strong evidence trail makes final reporting easier and reduces regulatory risk.
- Preserve decisions, timestamps, report drafts, and submission receipts.
- Record whether affected components are fixed, mitigated, not affected, or still under investigation.
- Connect final reports to product lifecycle and conformity evidence.
Common questions
When do CRA reporting obligations begin?
CRA reporting obligations begin on 11 September 2026. Full CRA application follows on 11 December 2027.
What triggers the 24-hour CRA clock?
The reporting clock is triggered when an in-scope actively exploited vulnerability or severe incident becomes reportable under the CRA and the manufacturer becomes aware of it.
How does cramio help with CRA reporting deadlines?
cramio connects product inventory, SBOMs, CVEs, incidents, timers, report preparation, and evidence records so teams can manage 24-hour, 72-hour, and 14-day reporting workflows in one place.